Getting started with the Splunk App for Lookup File Editing

Using the Splunk App for Lookup File Editing, you can edit, import, and export KV store and CSV file lookups in an interface similar to Microsoft Excel.

Use the Splunk App for Lookup File Editing to complete the following tasks:

• Review your saved lookup files
• Create new lookups
• Review lookup file metrics and logs with dashboards
• Run Splunk searches and explore your data

Review your saved lookup files

Select the Lookups tab to view a list of your saved lookup files. You can sort the view by selecting any column header. You can also search for a particular lookup file or filter the lookup file list by share settings, lookup type, affiliated app, or name. For example, select Mine to filter for lookups owned by you.

Select the name of a lookup file to view and edit that file. You can only view or edit a lookup file that's 10 MB or smaller in size. Depending on your app permissions, you can also export, open in search, and delete any lookup file using the Actions icons on the lookups table.

To find the size of a lookup or the total backup size for a lookup, hover over the lookup in the lookups table.

To turn on or turn off a KV store lookup file, select the toggle switch in the Actions column of the lookups table. Confirm that you want to turn off a lookup file by selecting Turn off.

Create new lookups

Select the New Lookup tab to create a new CSV file or KV store lookup. For step-by-step instructions, see Create a new lookup in the Splunk App for Lookup File Editing.

Review lookup file metrics and logs with dashboards

Select the Health tab to view the latest log and debug information. You can select the following views:

View	What you can do
Overview	Manage your lookup files using metrics and visualizations on lookup file size, backups, and more. For example, you can track CSV lookups using a table visualization sorted by total backup size.
Logs	Select a time range and severity type for your logs. Dashboard panels include Logs by Severity (over time), Log Severity, and Latest Log. You can select results within these panels to open a new search.
Status	See the current status of the Splunk App for Lookup File Editing.

The application does not work if one of the REST Handlers is offline.

Run Splunk searches and explore your data

Select the Search tab to run a Splunk search and explore you datasets, reports, alerts, and dashboards. These resources are not limited to the Splunk App for Lookup File Editing.